frogo-the-lord[.]gate-cryptolist[.]com

The domain frogo-the-lord.gate-cryptolist.com was registered through Key-Systems GmbH on 17 June 2024. DNS resolution points to the IP address 188.114.96.3 and the authoritative name servers are dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. An HTTP request to the host returned a 200 OK status, confirming that a web service was active at the time of observation. The site has since been taken offline, but the infrastructure remains observable.

VirusTotal analysis shows that 13 out of 91 security vendors flagged the domain, providing moderate detection confidence. The domain is listed on at least one public blocklist, specifically PhishDestroy, and it also appears on a generic security blocklist counted as a single entry. No additional threat intelligence sources such as Google Safe Browsing, OTX, or SSL certificate details were supplied, leaving the exact content and malicious payload unknown. Given the registration date, active web service, detection count, and inclusion on PhishDestroy, the domain should be treated as a confirmed phishing infrastructure.

Defenders should immediately block DNS resolution to 188.114.96.3 and add frogo-the-lord.gate-cryptolist.com to perimeter firewalls, proxy deny lists, and endpoint web‑filter rules. Continuous monitoring of traffic to the associated Cloudflare name servers is advisable to detect any re‑hosting attempts. Because the page title and internal content have not been released, analysts should request a sandbox capture if the domain reappears, enabling verification of the phishing technique and any credential‑stealing forms. Until further forensic detail is obtained, the precautionary stance of offline containment and network‑level blocking is recommended.